What is the CVSS score of CVE-2026-61122?

CVE-2026-61122 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61122?

Oracle E-Business Suite versions 12.2.9 through 12.2.15 contain an authentication-bypass vulnerability in the HRMS UK Payroll module that enables authenticated users with low privileges to read,…

How to fix or mitigate CVE-2026-61122?

Within 24 hours: Identify all Oracle E-Business Suite 12.2.9 through 12.2.15 instances with HRMS UK Payroll enabled; implement firewall rules to restrict network access to HRMS to authorized internal sources only; audit and preserve all HRMS access logs for forensic review. Within 7 days: Deploy network segmentation isolating affected HRMS systems; conduct an access control audit to identify and remove unnecessary low-privilege HRMS accounts; mandate HTTPS-only access and implement additional authentication controls at the application level. Within 30 days: Develop an upgrade timeline to move beyond Oracle E-Business Suite 12.2.15; establish vendor contact to obtain interim security guidance; deploy enhanced monitoring for unauthorized HRMS data access and anomalies.

Oracle E-Business Suite CVE-2026-61122

EUVD-2026-47332 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-fq52-jgpg-c5q2

Authentication Bypass Oracle Human Resources Management System

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reach with a low-privileged authenticated account (PR:L) and no user interaction yields high confidentiality and integrity impact but no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:42 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HRMS (UK) accessible data as well as unauthorized access to critical data or complete access to all Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, delete, or modify all HRMS (UK)-accessible data over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impacts and no availability impact, Oracle describes it as easily exploitable and tags it as an authentication-bypass class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the UK Payroll module of Oracle Human Resources Management System (HRMS) within Oracle E-Business Suite (EBS), Oracle's flagship on-premises ERP platform fronted by Oracle Application Server / WebLogic and accessed over HTTP(S). EBS 12.2.x uses a servlet/OA Framework web tier where individual product modules expose functionality to authenticated application users. No CWE was assigned by NVD; based on the description (a low-privileged user gaining broad read/write over all module-accessible data) and the vendor 'Authentication Bypass' tag, the root cause is most consistent with a missing or broken authorization/access-control check (CWE-862/CWE-863 class) that lets one authenticated principal reach data beyond its intended privilege boundary. The relevant product identifier is cpe:2.3:a:oracle:hrms covering 12.2.9 through 12.2.15, but NVD published no machine-readable CPE in the provided data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch set and any prerequisite EBS 12.2.x codelevel required for your release (Patch available per vendor advisory - no single fixed build version was provided, so map your installed version 12.2.9-12.2.15 to the corresponding CPU patch). Because this ships via Oracle's quarterly CPU, prioritize it in your next EBS patching window and test in a non-production instance first, as payroll patches can affect downstream reports and integrations. Until patched, reduce exposure with compensating controls: restrict network access to the EBS web tier and UK Payroll responsibilities to trusted VLANs/VPN only, tighten Oracle EBS responsibility and function-security assignments so low-privileged accounts cannot reach HRMS (UK) menus, and enable auditing on payroll/HR data access to detect anomalous read or modify activity - noting these controls limit reach but do not fully close the underlying authorization flaw.